Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 26 Aug 2008 18:53:21 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: coley@...re.org
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request (gpicview)

Hello Steve,

  On Tue, 2008-08-26 at 10:19 -0400, Steven M. Christey wrote:
> Jan,
> 
> Are there common usage scenarios under which gpicview would receive the
> filename to create from some external source, say, as a web browser
> plugin?
> 
> I'm asking because the missing "ask_before_save" issues only seem like
> non-security bugs - the user messing him/herself up - unless the target
> file can be influenced by an external attacker.

I can't see any possibility, how the last two issues could be used by
an external attacker to destroy the targeted user image files 
(when not considering the attack possible via CVE-2008-3791).

> 
> > http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869
> >
> > Possible symlink attack via the temporary created "/tmp/rot.jpg"
> > file used for image rotation.
> 
> Use CVE-2008-3791
> 
> > 2, http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869
> > 3, > http://sourceforge.net/tracker/index.php?func=detail&aid=2019492&group_id=180858&atid=894869

> These two might need a second CVE depending on the influence over the file
> that "ask_before_save" would ask about.

These two rather normal bugs, than a security issues. 

Thank you for checking!

Regards
Jan iankko Lieskovsky
RH Security Response Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.